CVE-2024-49994
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
An integer overflow vulnerability was discovered in the Linux kernel's BLKSECDISCARD operation. Passing crafted values (sector 512 and a near-maximum uint64_t sector count) causes an infinite loop in blkdev_issue_secure_erase(), leading to system overload and hang.
Risk Assessment
An attacker with local access to a block device can trigger a denial of service by sending a specially crafted BLKSECDISCARD ioctl, potentially causing system unresponsiveness or resource exhaustion.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155) or apply the appropriate security patch provided by your distribution.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: block: fix integer overflow in BLKSECDISCARD I independently rediscovered commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 block: fix overflow in blk_ioctl_discard() but for secure erase. Same problem: uint64_t r[2] = {512, 18446744073709551104ULL}; ioctl(fd, BLKSECDISCARD, r); will enter near infinite loop inside blkdev_issue_secure_erase(): a.out: attempt to access beyond end of device loop0: rw=5, sector=3399043073, nr_sectors = 1024 limit=2048 bio_check_eod: 3286214 callbacks suppressed